Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application that parses an attacker-supplied SoundFont 2 file. The SF2 parser derives the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without first rejecting chunks smaller than a single record, so a zero-sized DMOD chunk underflows the unsigned subtraction to UINT_MAX and the loader attempts to allocate billions of SFMod structures until process memory is exhausted. Rated CVSS 6.2 (AV:L/AC:L/PR:N/UI:N, availability-only), the issue requires only that a crafted .sf2 file be loaded locally (no privileges and no user interaction beyond opening the file), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-released patch is version 2.5.6.
Cross-site scripting in Moonshot AI's Kimi web application (kimi.com, affected as of 2026-07-18) lets a remote, unauthenticated attacker publish a crafted HTML artifact through the public Share view so that the artifact Preview rendering path executes attacker-supplied JavaScript in the Kimi origin. The flaw is exploitable only against a victim who opens the attacker's share link (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, CVSS 6.1) - there is no zero-click path, and impact is confined to the victim's browser session in the Kimi origin (S:C with limited confidentiality and integrity effects). The references include a public GitHub repository (MGTx2/CVE-2026-79294) that appears to document the issue, so proof-of-concept material may be publicly accessible; there is no CISA KEV entry and no confirmation of active exploitation at time of analysis. Note that although the CVE description says 'execute arbitrary code,' the assessed impact is arbitrary client-side JavaScript execution, not server-side code execution.
Blind server-side request forgery in the Nextcloud Circles (Teams) app lets any unauthenticated remote user force the Nextcloud Server to issue an outbound GET request to an attacker-chosen internal or private address through the public endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/. The flaw sits in remote-instance signature verification, which fetches the attacker-supplied keyId URL before trust in the remote instance is established and explicitly permits local and private address ranges, bypassing Nextcloud's core SSRF protections. Because the internal response body is never returned to the requester, the practical impact is internal-network reconnaissance - an attacker can map which services are reachable - rather than data theft or code execution; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, treating it as a moderate-severity reconnaissance primitive.
Improper authentication in the password-change handler of gedelumbung HospitalManagement allows an authenticated low-privilege user to tamper with another account's credentials by manipulating the kode_user/username argument passed to the simpan actions in application/modules/global/controllers/password.php and profil.php. The flaw is network-reachable, requires no victim interaction (CVSS:4.0 AV:N/AC:L/PR:L/UI:N) and yields partial confidentiality, integrity and availability impact (VC:L/VI:L/VA:L), consistent with the 5.3 base score; because the identifier is not bound to the caller's session, an attacker holding any valid account can target other users' password/profile records. Publicly available exploit code exists - the disclosure was filed as a public GitHub issue against the project - but there is no indication of confirmed active exploitation, and the maintainer has not responded or published a fix.
Cross-site scripting in the hosted Microsoft Azure Portal (CVE-2026-83946) allows an unauthenticated attacker to have malicious script rendered inside the privileged portal origin, escaping into a trusted administrative context once an authenticated portal user (typically an administrator) loads or clicks attacker-controlled content. The vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N rates this 8.2 (High), driven chiefly by the scope change (S:C) and high confidentiality impact (C:H) - meaning injected script can read data across the portal origin - with the required victim interaction (UI:R) as the main limiting factor. No CISA KEV listing and no public exploit code was identified at time of analysis, and because Azure Portal is a Microsoft-operated service, the issue was remediated server-side, so no customer patch or upgrade exists or is needed.
Null pointer dereference in Freedesktop Poppler 26.07.0 within JBIG2Stream::rewind lets an unauthenticated remote attacker deliver a crafted PDF containing a malformed JBIG2 stream that crashes applications using Poppler for parsing, resulting in a low-severity denial of service. The victim must open or render the document (UI:P), and there is no server-side auto-trigger unless a backend automatically renders untrusted PDFs; impact is limited to a process crash, with no code execution or information disclosure. Publicly available exploit code exists, and the vendor has released Poppler 26.08.0 with patch commit 5e49250f13b0390edeb3f90eb4c02c9941f97067 to address the issue.
Integer overflow in Freedesktop Poppler 26.07.0's SampledFunction::SampledFunction (poppler/Function.cc) allows unauthenticated remote attackers to crash PDF-rendering applications by supplying a crafted PDF with an oversized BitsPerSample value, resulting in an availability-only denial of service. Exploitation requires a victim to open or render the malicious file (UI:P/UI:R), and publicly available exploit code exists; the issue is not confirmed as actively exploited in CISA KEV. With a CVSS 4.0 base score of 2.1 and an independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, the risk is low and confined to availability with no demonstrated confidentiality or integrity impact.
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated attacker embed arbitrary JavaScript into the interface, which executes in the browser of any user who is lured into rendering the crafted content; because the script runs inside a trusted, authenticated licensing session, the realistic outcome is theft of that session's credentials or manipulation of the displayed licensing data. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) confirms no attacker authentication is needed but that exploitation depends on victim interaction, and the changed scope indicates the injected payload can affect resources beyond the vulnerable component. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the vendor has published a fix, and the primary limiting factor remains the narrow footprint of the licensing component and the requirement for a reachable Web UI plus a legitimate user to trigger the payload.
Reflected cross-site scripting in IBM Financial Transaction Manager for SWIFT Services for Multiplatforms (versions 3.2.4.0 through 3.2.4.16) lets an unauthenticated attacker inject arbitrary JavaScript into the Web UI, which then executes in the browser of any authenticated user who loads the crafted content. Because the payload runs inside a trusted, already-authenticated session, the realistic impact is disclosure of that user's credentials or session data rather than server compromise; exploitation is constrained by the mandatory requirement that a victim interact with attacker-supplied content (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/). No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor has published remediation guidance.
Reflected cross-site scripting (XSS) in the Qi Addons For Elementor plugin for WordPress (versions up to and including 1.11) allows unauthenticated remote attackers to inject arbitrary web scripts via the 's' search parameter, but exploitation is highly conditional: it requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., sitewide header or footer) with the 'Limit ToC to Main Page Content' option left at its default value of No, and it requires victim interaction (opening a crafted search URL). The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and no public exploit identified at time of analysis.
Reflected cross-site scripting in the ShopLentor (WooLentor Addons) WordPress plugin up to and including version 3.5.1 lets unauthenticated attackers inject arbitrary JavaScript into a page by abusing the name of a query-string parameter, which the WL: Product Horizontal Filter widget reflects unescaped into an option element value attribute. Exploitation requires the victim to click an attacker-supplied link that carries the payload in the parameter name (UI:R) and only works on published pages where that widget has actually been placed, so the result is non-persistent script execution scoped to the WordPress origin; the higher-value outcome, abuse of an authenticated administrator session, requires luring a logged-in admin to the crafted URL. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is assessed as a genuine but moderate-severity problem (CVSS 6.1, scope-changed reflected XSS) rather than a mass-exploitation candidate.
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthenticated attackers (CVSS PR:N) embed arbitrary JavaScript in the licensing Web UI, which executes in the browser of a victim who interacts with the crafted content (UI:R), potentially disclosing credentials or session data within a trusted session (CVSS 6.1, S:C/C:L/I:L/A:N). Only these specific Agent and ART builds are affected, and because the component is a backend licensing interface rather than a public-facing web application, opportunistic drive-by exploitation is limited; no public exploit identified at time of analysis. Successful exploitation still depends on a logged-in operator or administrator viewing attacker-influenced content, which is the primary limiting factor.
Rendering a crafted PDF with Freedesktop Poppler 26.07.0 can trigger a signed integer overflow in the TrueType font handler FoFiTrueType::mapCodeToGID when an embedded font supplies a manipulated segCnt value, producing a crash or a bounded out-of-bounds read rather than confirmed code execution. The flaw is remotely reachable with no authentication (CVSS 4.0 PR:N, CVSS 3.1 PR:N) but requires the victim or an automated pipeline to open or convert the attacker-supplied document (UI:P/UI:R), so it is not a hands-off network exploit; publicly available exploit code exists but there is no indication of confirmed active exploitation (no CISA KEV listing). With a base score of 5.3 and C:L/I:L/A:L on the assessed 3.1 vector, this is a moderate, opportunistic-risk issue rather than a top-tier priority, and it matters most to environments that automatically render or convert untrusted PDFs at scale.
Cross-site scripting and JSON injection in the Quarkus Qute template engine stem from the {#eval} section helper failing to pass the parent template's content type to the sub-template it evaluates, so contextual escaping is skipped and untrusted data is emitted as raw HTML or JSON. The flaw reaches Red Hat Build of Quarkus and downstream Red Hat offerings that bundle Qute (Red Hat Build of Apache Camel 4 for Quarkus 3, Red Hat Build of Keycloak, Red Hat Build of Apicurio Registry 3 and Red Hat Fuse 7), but only where an application passes attacker-influenced data into {#eval}. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1): payload submission needs no authentication (PR:N), yet a victim must render the affected page for script execution to occur, and impact is confined to that victim's browser context (C:L/I:L/A:N); no public exploit identified at time of analysis.
Cross-site scripting in HCL BigFix Service Management lets an attacker who already holds a valid low-privilege account (CVSS PR:L) inject unsanitized script into content that executes in another user's browser when that user views it (UI:R), enabling session hijacking, account takeover, and unauthorized actions performed as the victim. Impact is greatest when the viewing victim is a higher-privileged user such as an agent or administrator, because the injected script then runs with that user's session context. No public exploit identified at time of analysis, and because the affected component is a niche enterprise ITSM module rather than broadly deployed software, this remains a moderate-priority issue.
Reflected cross-site scripting in Semantic MediaWiki 7.0.0 through 7.1.0 lets an unauthenticated attacker execute arbitrary script in a victim's browser on the wiki origin by tricking them into opening a crafted Special:Ask link carrying a forged cursor pagination token. The cursor parameter added in 7.0.0 is an unsigned base64url-encoded JSON blob, so its sort_prop and sort_order fields are fully attacker-controlled; when they mismatch the request's sort=/order= values, the resulting error string is interpolated into Query::addErrors() and rendered as raw HTML by Html::errorBox(), bypassing the message-layer sanitization that normally protects SMW error output. Exploitation requires victim interaction (clicking the link) and is aided by the absence of a Content-Security-Policy on responses, which permits inline script to run; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the maintainer advisory documents a browser-confirmed reproduction, and the CVSS 3.1 score is 6.1 with a scope change. Upgrading to 7.2.0 removes the vulnerability.
HTML/CSS injection in Open edX Platform discussion-notification emails allows an authenticated, enrolled student to embed CSS-capable markup in a discussion post title, which is then interpolated without sanitization into digest and batched-email notification content and rendered as trusted HTML; when another learner opens that email in a client that renders CSS, the attacker gains email-open tracking, content spoofing, and a credible phishing vector. The issue affects releases from Redwood up to (but not including) Ulmo and prior to Verawood.1, and is fixed in Ulmo and Verawood.1. Exploitation requires course enrollment, digest or batched (non-immediate) notification delivery, and victim interaction with the email, and no public exploit has been identified at time of analysis.
Heap out-of-bounds read in OpenImageIO's IFF image reader (src/iff.imageio/iffinput.cpp, IffInput::readimg()) affects all releases prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, allowing a caller that opens a crafted uncompressed 16-bit IFF file containing a z-buffer channel to trigger a crash or leak adjacent heap contents into the decoded image output. The flaw is an allocation/stride mismatch: the temporary scanline buffer is sized from m_header.rgba_count while the subsequent memcpy uses m_header.pixel_bytes(), whose stride also counts z-buffer bytes, producing an oversized copy. Exploitation requires local, user-initiated parsing of the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 6.1) with no privileges needed but no remote zero-interaction path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV data were not provided. Vendor-released patches exist in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
Stack-based buffer overflow in OpenImageIO's Cineon image reader (CineonInput::open()) lets a crafted .cin file that declares more than the format's maximum of eight channels overwrite stack pointers and corrupt adjacent memory, crashing the application that processes it. Exploitation requires the victim or an automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, 6.1), so it cannot be triggered remotely without inducing file ingestion; the assessed impact is denial of service with only low integrity risk and no confidentiality loss. No public exploit identified at time of analysis and the issue is not in CISA KEV; vendor fixes shipped in OpenImageIO 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier lets an unauthenticated remote attacker inject arbitrary markup into the query debug output rendered on Special:Ask, executing JavaScript in the browser of a victim who follows a crafted link. No account, privilege, or attacker-created wiki content is required: the predefined text-type properties such as Text (_txt) that ship on every default install satisfy the property-type condition the payload needs, so a URL like Special:Ask?q=[[Text::<script>...</script>]]&debug=1 is sufficient. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yields a 6.1 base score, reflecting a scope-changing, low-impact script injection that depends on user interaction and is therefore not self-propagating or wormable; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing). Vendor-released patch: 7.2.0.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier allows unauthenticated attackers to inject arbitrary HTML markup into the Special:Ask table output by abusing the `sep` (separator) parameter, which was inserted verbatim into the HTML that joins a table cell's values. Because the same unsanitized table HTML is produced for the raw request output (request_type=raw), no authentication is needed to reach the injection, though exploitation is limited by user interaction: a victim must be induced to load a crafted query URL for the payload to execute in their browser. The issue is correctly rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) as a moderate-severity reflected XSS; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in version 7.2.0.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier allows an attacker to inject script into the Special:SearchByProperty page through the `property` and `value` query parameters, executing arbitrary JavaScript in the browser of any wiki user lured to a crafted URL. Rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the flaw needs no authentication to construct or deliver the malicious link but does require victim interaction (UI:R), and impact is confined to the victim's browser session with no server-side code execution. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor released a fix in SMW 7.2.0 that escapes both the reflected form value and the derived error messages.
Reflected cross-site scripting (CWE-79) in Semantic MediaWiki 7.1.0 and earlier allows a crafted URL to execute script in a victim's browser session; the flaw is reached through the Special:Ask result printer when it is invoked with headers=plain and an attacker-controlled mainlabel value, which is written into the table header (<th>) through a raw HTML path instead of being escaped for the output context. The vulnerability is rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no authentication is needed to craft the link, but exploitation depends on the victim opening the malicious URL (user interaction is required) and impact scales with the victim's wiki privileges. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in Semantic MediaWiki 7.2.0, so deployments on 7.1.0 or earlier that expose Special:Ask queries are the realistic exposure.
An open redirect in the Semantic MediaWiki extension (versions up to and including 7.1.0) lets an unauthenticated remote attacker craft a Special:URIResolver subpage link that issues an HTTP 303 redirect to an off-host destination, optionally embedding user:pass@host credentials in the URL authority. Because the redirect originates from a trusted wiki domain, the link is usable for phishing or credential-harvesting lures, though exploitation requires the victim to follow the crafted URL (UI:R) and no server data disclosure or code execution results directly. There is no indication of active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; the vendor addressed the flaw in Semantic MediaWiki 7.2.0.
Local low-privileged users on Red Hat Enterprise Linux 9 and 10 systems running the cockpit-files module can abuse the privileged 'Paste as owner' feature by pre-staging a directory that contains a symbolic link, causing ownership changes to be applied to files outside the intended paste destination and thereby compromising data integrity (and, in some cases, confidentiality if the new ownership grants unauthorized read access). Exploitation is not remote - it requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) and only completes when a more privileged operator performs the paste and actively selects a non-original owner, which is the primary limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is a genuine but locally scoped privilege/integrity problem, not a high-urgency remote threat.
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2) Web UI lets an unauthenticated attacker embed arbitrary JavaScript that executes in a victim's browser session, potentially altering page behavior and exposing credentials. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1), meaning a user - typically an administrator or operator - must load the attacker-influenced page inside an authenticated, trusted session for the payload to fire; no attacker authentication is required. There is no CISA KEV entry and no public exploit identified at time of analysis, and a vendor patch is available, so this is a genuine but moderate-priority issue whose real-world risk depends largely on whether the licensing Web UI is exposed to untrusted or internet-facing users rather than confined to an isolated management network.
Cross-site request forgery in HospitalManagement allows remote attackers to trick an authenticated user's browser into submitting forged state-changing requests against the application. All versions are affected because the project follows a rolling-release model, and the maintainer has not released a fix after being notified via an early issue report. Publicly available exploit code exists, though there is no confirmed CISA KEV active exploitation; our independent assessment rates this low priority because it requires the victim to be logged in, depends on social engineering to deliver the malicious content, and causes only limited integrity impact (no data theft or service disruption).
Reflected cross-site scripting (CWE-79) in KA Informatics Technologies Ltd. Co. 'Bar Association Website' builds through 18092026 lets remote, unauthenticated attackers inject script into pages that reflect user-supplied input, executing in the browser of any victim persuaded to open a crafted link. Per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1 medium), network reachability is trivial and no credentials are needed, but the attacker must first lure a targeted user into clicking the malicious URL, so this is not a no-interaction or mass-automatable flaw; impact is confined to the victim's browser session (limited confidentiality/integrity, no server compromise). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the vendor was contacted and did not respond, so no vendor-released patch was identified at time of analysis - remediation currently depends on WAF filtering, output encoding, or removing the vulnerable reflection point.
Reflected cross-site scripting in The Newsletter - Send awesome emails from WordPress plugin (satollo) versions up to and including 9.3.8 lets an unauthenticated attacker deliver a crafted link containing a malicious 'nn' parameter that executes script in the browser of a logged-in WordPress administrator who clicks it. The payload only survives to the reflected output branch of the plugin's dienow() function for authenticated users, because the built-in antibot/antispam check auto-passes logged-in accounts and returns the unsanitized value in administrator-visible output; anonymous or non-admin visitors do not trigger the sink. Impact is limited to session/token theft or admin-performed actions in the WordPress context of the victim (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), making it a genuine but contained issue that requires a specific social-engineering step against an administrator.
Reflected cross-site scripting in the Booking Calendar WordPress plugin through 11.8.2 enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via the 'options' parameter, provided they can trick the user into clicking a crafted link (CVSS 6.1, user interaction required). The nonce check that would normally block unauthenticated requests is bypassed on default installations because the 'booking_is_nonce_at_front_end' option ships disabled, making default setups exploitable. No public exploit code has been identified at time of analysis, but the flaw is reflected rather than stored, so each victim must be individually lured-limiting mass exploitation while still posing a moderate risk.
Reflected cross-site scripting in the EmbedPress WordPress plugin through version 4.6.5 lets unauthenticated attackers inject arbitrary JavaScript into a page returned to a victim who clicks a crafted link carrying a payload in the plugin's 'unique' parameter. Any WordPress site with the plugin installed and active at or below 4.6.5 is exposed, though exploitation depends on successful social engineering because the script is reflected per-request rather than stored, and the most impactful target is a logged-in administrator. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; this is a moderate, vendor-assigned CVSS 6.1 issue and a regression of CVE-2023-5749, whose esc_url() escaping was removed in the 4.3.0 refactor that introduced the 'unique' parameter.
Integer overflow in the JBIG2 code-table parser (JBIG2Stream::readCodeTableSeg) of Freedesktop Poppler 26.07.0 allows a remote attacker to crash or destabilize the rendering process by supplying a crafted PDF that embeds a malicious JBIG2 image stream. The flaw is reachable without authentication, but requires the victim to open the document or have a batch tool such as pdftoppm or pdfimages process it, and the independent assessment limits realistic impact to denial of service (integrity and confidentiality are unaffected). Publicly available exploit code exists (a write-up and PoC linked from the CVE references), and the CISA KEV catalog does not list this CVE, so it is a low-to-moderate, non-urgent memory-safety issue rather than a confirmed actively exploited threat.
A local time-of-check/time-of-use (TOCTOU) race condition in cockpit-files on Red Hat Enterprise Linux 9 and 10 allows an unprivileged local attacker to redirect a privileged chown operation to an arbitrary file by replacing a newly created directory with a symlink, resulting in potential information disclosure or unauthorized modification of sensitive files. Exploitation requires a privileged operator to trigger directory creation with owner assignment via cockpit-files inside an attacker-controlled writable parent directory, and the attacker must win a narrow timing window (CVSS 3.1: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.0). No public exploit code or confirmed active exploitation was identified at time of analysis; this is a modest-priority local privilege/integrity issue rather than a mass-exploitation threat.
A symlink race condition (CWE-363) in cockpit-files, the file-management component shipped with the Cockpit web console on Red Hat Enterprise Linux 9 and RHEL 10, lets a local attacker with an unprivileged shell account redirect privileged file-ownership or permission changes to arbitrary files. Exploitation requires the attacker to win a narrow, non-deterministic timing window while an administrator concurrently performs a chown or chmod operation through the cockpit-files UI, so the practical result is unauthorized modification of file ownership/permissions affecting system integrity and availability rather than confidentiality. There is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation; this is a moderate-severity local integrity issue, not an urgent internet-facing threat.
Denial of service in Red Hat's cockpit-ws web service lets a remote, unauthenticated attacker crash the process by sending a request to the exact configured WebService.UrlRoot prefix without a trailing slash, taking the Cockpit management interface offline. The flaw is only reachable on installations that have explicitly set the non-default WebService.UrlRoot option; default deployments are unaffected, and impact is availability-only with no data exposure or code execution. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and exploitation carries a high-attack-complexity rating (AC:H) because the attacker must know and target the exact URL-root path.
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated remote attacker inject arbitrary JavaScript into web management pages that is then executed in the browser of a user who views the injected content, because user-supplied input is not properly neutralized during page generation (CWE-79). Exploitation requires a valid low-privileged session on the appliance (CVSS vector PR:L) and, in practice, a second user - typically an operator or administrator - to render the tampered page, which is why our independent assessment scores it slightly differently from the vendor's CVSS 3.1 base of 5.9 (vendor UI:N, assessed UI:R with scope change). No public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the high attack complexity, the credential prerequisite, and the confined web-management context of a niche data-security appliance.
Information disclosure in IBM Cognos Analytics 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 allows an unauthenticated attacker on a shared network segment to capture sensitive data because the product uses insecure network communication (CWE-327). Exploitation requires the attacker to achieve a man-in-the-middle or traffic-capture position on the same network, making it impractical over the open internet; the impact is limited to confidentiality. The vendor CVSS score of 5.9 is a fair reflection of the moderate risk, no public exploit code has been identified, and a vendor patch is available.
IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 send sensitive data in cleartext, allowing an attacker who occupies a man-in-the-middle position on the network path to capture confidential information. Exploitation requires an on-path adversary (e.g., via ARP or DNS spoofing or a compromised intermediary) but no authentication or user interaction; the CVSS 3.1 base score is 5.9 with high confidentiality impact but no integrity or availability impact. No public exploit code or confirmed active exploitation has been identified, and IBM has released a patch.
CRL revocation-check bypass in rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 can cause revoked X.509 certificates to be accepted when a relying application uses the non-default UnknownStatusPolicy::Allow, because the CRL authority-matching logic compares only a certificate's first distributionPoint against each CRL's IssuingDistributionPoint and ignores any additional distributionPoints. Exploitation requires an attacker who has already compromised a trusted issuing CA (a high-privilege position, consistent with the CVSS PR:H vector) plus a target certificate that carries more than one CRL distributionPoint; the default UnknownStatusPolicy::Deny fails safe by returning Error::UnknownRevocationStatus instead of accepting the certificate. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the mid-range 5.9 CVSS 4.0 score overstates what the vendor and independent analysis both describe as a limited-impact, largely latent issue that would most plausibly let an attacker keep using an already-revoked credential.
Certificate revocation checking in the OCSP client shipped with Red Hat Build of Apache Camel for Spring Boot 4 can be bypassed because the client does not verify the OCSP-signing Extended Key Usage (EKU) on the certificate that signs an OCSP response, allowing a revoked certificate that still chains to a trusted CA to be accepted as valid. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), although exploitation is conditional: the deployment must actually rely on this OCSP client for revocation checking and the attacker must already possess a revoked-but-chainable certificate. No public exploit identified at time of analysis, and this is assessed as a genuine but moderate-priority integrity flaw rather than a high-urgency issue.
Certificate revocation validation performed by Netty's optional netty-handler-ssl-ocsp module can be silently skipped when the OCSP response omits the optional nextUpdate field, causing the application to proceed with a certificate that should have been rejected. The flaw is remote and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), but exploitation is conditional: the deployment must actually use the opt-in OCSP-stapling component, and the attacker must control or intercept the OCSP response seen by the client, typically through a man-in-the-middle position or by operating the TLS server whose certificate is being validated. There is no public exploit identified at time of analysis and no KEV listing, and the practical impact is confined to acceptance of a revoked or otherwise unvalidated certificate rather than code execution or data disclosure.
Broken object-level authorization (IDOR/BOLA) in CordysCRM allows any authenticated user holding the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission to read leads and customer accounts belonging to other users, departments, or organizations by supplying an arbitrary record ID to GET /pool/lead/get/{id} or GET /pool/account/get/{id}. The flaw affects all CordysCRM deployments prior to version 1.7.4 and is read-only in effect, but it exposes highly sensitive CRM data including contact names, phone numbers, owner and department attribution, and custom field values, with no special privileges, administrative rights, or non-default configuration required beyond valid credentials. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is an authenticated information-disclosure issue rather than an RCE-class emergency, though the confidence is high because the affected code path is the default behavior of every pre-1.7.4 install.
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make the application server issue requests to internal systems that are not reachable from the internet, potentially exposing internal APIs, admin interfaces, or cloud metadata services. The vendor scores this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but our independent assessment places it lower: the scope-change and high-confidentiality components are contestable, and realistic impact depends on whether the deployment has internal routes worth abusing and on whether responses are reflected to the attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, though the unauthenticated, no-interaction attack profile (PR:N/UI:N) makes this a strong candidate for automated scanning against internet-exposed instances.
Remote command injection in marcopiovanello yt-dlp-web-ui up to v4 lets a remote attacker (CVSS 4.0 vector records PR:N/UI:N, i.e. unauthenticated and no user interaction) abuse the params argument processed by NewGenericDownload in server/internal/downloaders/generic.go to inject arbitrary yt-dlp flags and shell metacharacters into the spawned download command. Publicly available exploit code exists - the flaw was publicly disclosed alongside the CVE, so any network-reachable instance of the generic download feature is a realistic target; there is no indication of confirmed active exploitation (not in CISA KEV). An upstream fix commit (c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897) replaces the previous weak sanitizer with a strict allowlist of yt-dlp flags, but no tagged patched release version is confirmed in the available data, so operators must either track the commit or restrict exposure.
Error-based SQL injection in CordysCRM 1.7.0 through pre-1.7.4 lets an authenticated user holding the MODULE_SETTING_UPDATE permission inject database functions into the sort parameter of POST /account-pool/page, exposing database values through an error oracle when the query returns at least one row. No public exploit code is identified at time of analysis, and the independently assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). The vendor fixed the flaw in version 1.7.4.
Imager for Perl before 1.036 can leak uninitialised process heap memory when an application reads an attacker-supplied paletted image and then retrieves its pixels or converts it to RGB, because palette entries beyond the number of colours populated by the reader are read without being initialised. The TGA reader stores pixel indexes without validating them against the colour map, and the affected accessors (i_gpix_p, i_glin_p) mishandle indexes equal to or past the populated count, returning zeroed-but-uninitialised heap contents as pixel data. Exploitation is local (AV:L) and requires user or application interaction to load and then read back the crafted image (UI:R); no public exploit code has been identified at time of analysis and CISA KEV does not list this issue, while EPSS is very low (0.18%, 8th percentile). The vendor-released patch is Imager 1.036, which allocates and zero-initialises a full 256-entry palette and corrects the out-of-range checks.
Denial of service in OpenImageIO's PSD reader allows a crafted PSD file carrying an invalid color_mode value to index beyond the fixed color-mode tables, producing a global out-of-bounds read and potentially a bogus allocation that crashes the reading process. The exposure is narrow: the raw path is only reachable when the non-default oiio:RawColor or psd:RawData option is explicitly enabled, and an attacker must get a target application or automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5, CWE-125), so impact is availability-only with no confidentiality or integrity effect. No public exploit has been identified at time of analysis, and vendor-released fixes exist in 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Denial of service in OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1 occurs when the library processes a truncated TGA file while writing GIF output, triggering a signed 32-bit integer overflow in GifSplitPalette() that leads to an out-of-bounds read (CWE-125) and a process crash. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates the attacker is unauthenticated (PR:N) but requires local access and user interaction, with no remote or unauthenticated network trigger. No public exploit code or active exploitation has been identified; this is a low-priority hardening issue for workflows that transcode untrusted images to GIF.
A heap out-of-bounds read in the OpenImageIO PSD reader can crash any application that processes a crafted indexed Photoshop (PSD) file while the non-default oiio:rawcolor or psd:rawdata option is enabled. The flaw affects OpenImageIO builds prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, where a PSD whose transparency metadata yields fewer stored channel buffers than the advertised channel count causes PSDInput::interleave_row() to read past the end of channel_buffers. Exploitation is local with required user interaction (the victim must supply or open the malicious file), the vulnerable rawcolor/rawdata path is not the default configuration, and impact is limited to a denial-of-service crash of the processing process, with no code execution or data disclosure reported; no public exploit has been identified at time of analysis, and CVSS 5.5 (A:H, C:N/I:N) reflects the availability-only, non-default-path nature of the issue.